The problem of dispatching/killing/reaping child processes while avoiding zombies, and the problem of breaking out of a blocking call using an alarm are two separate problems. I recommend a study of the perlipc perldoc. It discusses both issues in detail.

UPDATE:

I was probably too glib in my initial reply. The real answer is, "maybe". Normally, the alarm is set in an eval {} block: you execute a "die" to break out of the block when the alarm goes off. The die will kill the system command, but whether the program running inside system() will a) die; and b) get reaped is probably OS/command specific. I will say that I'm using alarm/system/die blocks in some of my code and I haven't had any problems with leftover zombies on Fedora Linux. If you are, you may have to check/kill them yourself if you get a timeout or go the fork/exec/wait route and set your alarm on the wait.